CVE-2022-21449

mediumPriorität · beachten · 57EPSS 0.772 · 100. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

12 exploits · PoC

Likely / severe?

77.2% (100th) EPSS

CVSS 5 · medium

Is it mine?

43 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5–9.8

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · secalert_us@oracle.com USAusnutzbarkeit 3.9 · Auswirkung 3.6

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-347US

Exploits (12)

Öffentlicher Proof-of-Concept- und Exploit-Code.

AlexanderZinoni/CVE-2022-21449AlexanderZinoni/CVE-2022-21449PoC · poc_in_github
Damok82/SignCheckerTest tool to demonstrate the vulnerability of CVE-2022-21449PoC · poc_in_github
HeyMrSalt/AIS3-2024-Project-D5TeamReappear-CVE-2022-21449-TLS-PoCPoC · poc_in_github
Skipper7718/CVE-2022-21449-showcaseSkipper7718/CVE-2022-21449-showcasePoC · poc_in_github
davwwwx/CVE-2022-21449repo showcasing generating "psychic signatures for java" implemented in a nodejs environment 😅PoC · poc_in_github
fevra-dev/ClaimJumperProfessional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist, and CVE-specific attacks (CVE-2022-21449, CVE-2018-0114).PoC · poc_in_github

betroffene Produkte (43)

Betroffene Produkte und Versionsbereiche.

Xerox FreeFlow Print Server 7alle Versionencert_bundDEcpe:/a:xerox:freeflow_print_server:7
Xerox FreeFlow Print Server 9alle Versionencert_bundDEcpe:/a:xerox:freeflow_print_server:9
Xerox FreeFlow Print Server v9alle Versionencert_bundDEcpe:/a:xerox:freeflow_print_server:v9
Oracle Corporation Java SE JDK and JRE≤ Oracle Java SE:18enisa_euvdEU
Oracle Corporation Java SE JDK and JRE≤ Oracle GraalVM Enterprise Edition:21.3.1enisa_euvdEU
Oracle Corporation Java SE JDK and JRE≤ Oracle GraalVM Enterprise Edition:22.0.0.2enisa_euvdEU
Oracle Corporation Java SE JDK and JRE≤ Oracle Java SE:17.0.2enisa_euvdEU
Axiom JDK Axiom AxiomJDK≤ 17.0.2.0.1fstec_bduRU
Axiom JDK Axiom AxiomJDK≤ 17.0.3fstec_bduRU
IBM Corp. IBM Cloud Object Storage Systems3.16.0.121 → 3.16.7.55fstec_bduRU
Oracle Corp. GraalVM Enterprise Edition≤ 21.3.1fstec_bduRU
Oracle Corp. GraalVM Enterprise Edition≤ 22.0.0.2fstec_bduRU
Oracle Corp. Java SE≤ 17.0.2fstec_bduRU
Oracle Corp. Java SE≤ 18fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat Inc. Red Hat build of OpenJDK≤ 17fstec_bduRU
azul zulu= 15.38nvdUScpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
azul zulu= 17.32nvdUScpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
azul zulu= 18.28nvdUScpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*
debian debian linux= 10.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*

20 von 43 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2022-0200Oracle Java SE und OpenJDK: Mehrere SchwachstellenDeutsch2022-04-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE und OpenJDK ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2022-1335Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2022-09-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
BIT-java-2022-214492026-05-06vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
BIT-java-min-2022-214492026-05-06vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
BIT-jre-2022-214492026-05-08vendor · osvUS
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

veröffentlicht 2022-04-19geändert 2026-06-17

Referenzen (75)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan